Healthcare Cybersecurity Check-Up:

Achieving and Measuring Excellence

Session ID: CYB4, 1:15pm – 2:15pm, February 11, 2019

James Brady, PhD, CISSP, CISM, CRISC

Chief Information Officer, Los Angeles County Department of Health Services

James Brady, PhD, CISSP, CISM, CRISC

Has no real or apparent conflicts of interest to report.

Conflict of Interest

• Why Cybersecurity Matters

• Defining Cybersecurity

• Cybersecurity Report Card

• Assessing Your Cybersecurity Fitness

• Addressing Your Cybersecurity Weak & Strong Areas

Agenda

• Illustrate a healthcare organization’s assessment of their

cybersecurity program: “report card” and evaluations

• Explain how to systematically assess the “fitness” of your

organization’s cybersecurity program from a holistic perspective

• Discuss how to drive and manage change in weaker areas and

how to keep strong in areas of strength

Learning Objectives

Los Angeles County Department of Health Services

Why

Cybersecurity

Matters

Cyber incidents cause real harm — compromising

patient data, risking patient safety and

jeopardizing operations

Facebook

Blog

YouTube

Chat

Twitter

Instagram

SnapChat

417,000 Augusta

University Health patient

records breached exposing

sensitive patient data after

a phishing attack.

LifeBridge Health reveals breach

that compromised health data of

500,000 patients after malware

infection.

Office of Civil Rights and HHS

fine Fraesenius Medical $3.5

million for 5 breaches

violating HIPAA.

LA County 211

service breached

exposing PII and

sensitive call

details on 3.2

million records.

In 2016 Hollywood Presbyterian

ransomware WannaCry attack

disabled computer systems

disrupting clinical operations and

forcing the transfer of patients.

MedStar Health turns patients away

after virus attack requires network

shutdown in 2016.

There is also a cumulative impact associated with

cybersecurity incidents—leading to fines, lawsuits

and corrective action

Financial

A recent “Cost of Data Breach” study found that the

average cost for each lost or stolen record containing

confidential information was $141.

Reputational

Facebook shed slightly more than $100 billion in market

cap (almost 20% of its total value) for breaching its users'

trust following the Cambridge Analytica incident.

Regulatory

The GDPR can levy fines up to 4% of global turnover or €20M,

whichever is higher, for violations on any company worldwide

found mishandling personal data in scope.

RECEIPT

Note: The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

By 2020, national authorities in the U.S. and U.K. will mandate capture of

information related to cybersecurity breaches.

By 2021, at least one company will publicly acknowledge a $1 billion revenue

impact from a business outage resulting from a malware/ransomware attack.

Consumers are increasingly moving their business to where organizations are

personal information is best protected and cared for.

Importance of cybersecurity continues to

increase and is becoming vital to organizations

By 2022, cybersecurity ratings will become as important as credit ratings when

assessing the risk of business relationships.

Predicts 2018: Security and Risk Management Programs, Gartner - July 2018

Build for Privacy, Gartner - June 2018

Defining

Cybersecurity

Operational Security & Accessibility

Encompasses user level security measures

and standard role-based access restrictions.

Secures Existing Data

The secure storage and backup of data whether it

is located in the cloud on on-premise.

Privacy & Confidentiality

Control of information at various sensitivities,

limiting data visibility and maintaining access logs

Cybersecurity & Privacy

Cybersecurity

Privacy

Security is NOT privacy

 Organizations often mistake

security features, such as

access control or certified

cryptography, for privacy.

 Security makes up one

instrument in a varied toolbox of

capabilities to address privacy

requirements.

Subject Access Requests

Data

Classification

Adequate

Security

Dynamic

Masking

Structured

Unstructured

Subject Access Response

• Many healthcare organizations

structure cybersecurity efforts

primarily around HIPAA compliance.

• Mere compliance does NOT

inoculate the organization’s cyber

threats.

• Compliance with HIPAA is only the

starting point of healthcare data

security.

Compliance is NOT security

Security is NOT a Checklist or One Time Effort

Cybersecurity is the practice of protecting

systems, networks, and programs from

digital attacks to address RISK.

These attacks are usually aimed at:

• accessing, changing, or destroying

sensitive information;

• extorting money from users; or

• interrupting normal business processes

A continuous information risk management

program fully supported by the organization

is required!

Increased automation and complexity leads to

higher risk, driven by data amounts

Increasing Risk

External exchange of sensitive data via a

Health Information Exchange (HIE)

Internet of Things (IoT) including medical

and consumer grade devices

Multiple departments sharing data

across a Wide Area Network (WAN)

Centralized data warehouse storing data

from multiple disparate sources

Electronic Health Record processing

large amounts of sensitive personal data

Multiple PCs sharing data across a Local

Area Network (LAN)

Singular PC

Increasing Complexity

Cybersecurity

Report Card

Cybersecurity Report Card

 There is no such thing as perfect protection

 The investments made in cybersecurity are a

business decision and directly related to the level of

risk the business is willing to accept

 To engage in a meaningful discussion with the

business, it is imperative to understand the current

risk exposure and maturity so that the gaps can be

explained to the business

 Our organization is using a reference architecture

against which we assess our maturity. This results in

a report card that helps prioritize our investments in

security.

Level of risk you are willing to accept will

determine your cybersecurity strategy

Lower Risk

Higher Cost

Higher Maturity

There is no such thing as "perfect protection"

Less complex business,

less of a target

Growing business, more

customers and complexity

Larger, more complex

business, more of a target

Higher Risk

Lower Cost

Lower Maturity

Business Model

As our business grows, we have to continually reassess

how much risk is appropriate.

Our goal is to build a sustainable program that balances

the need to protect against the needs to run our business.

Won’t the business units choose poorly?

Won’t all the business units just select the lowest level of service/risk/cost?

They have to defend their selections to key

stakeholders such as the board, the executive

committee, the regulators, and their customers.

You can’t buy your way out of this problem and it is

equally problematic to select too little risk as it is to

select too much risk.

Won’t this force the business to take the highest level of service/risk/cost?

Understand the Messaging Behind the Concept of

Security Maturity

Security

Maturity

Weak/Ad Hoc Reactive Proactive Managed Optimized

RISK TOLERANCE

Composite

Risk

Cost &

Effort

The measurement of security maturity includes the aspects of existence, completeness,

comprehensiveness, effectiveness, and efficiency

Gartner Research Source: IT Score for Information Security, G00301271

MATURITY

PROFILE

Cybersecurity Reference Architecture

Application Security

Confidence in the ability of

software to provide the expected

level of transaction assurance

Change Management

Confidence in the ability of technology to provide the expected level of

data and system protection

Data Security

Confidence in the ability of users

and systems to provide the

required information protection

Endpoint Security

Confidence in the ability of

devices to provide the expected

level of data & access protection

Security

Governance

Confidence in

the ability of the

security program

to provide the

necessary level

of risk

management &

resolution

Physical Security

Confidence in the ability of facilities to provide the expected level of

environment, technology, personnel and data protection

Identity and

Access

Management

Confidence in the

ability of systems

to provide the

expected level of

data and system

access control

commensurate

with need and

authority

Mobile

Security

Confidence

in the ability

of devices

and to

provide the

expected

level of

data,

access and

transaction

protection

Network

Security

Confidence in

the ability of

the IT

architecture

to provide the

expected

level of IT

environment

protection

Security

Analytics

Confidence

in the ability

of the

security

program to

provide the

necessary

level of

proactive risk

detection

and

mitigation

Service Continuity

Confidence in the enterprise ability to meet business and customer

expectations for data and service restoration

Vulnerability

Management

Confidence in the

ability of devices,

systems and

infrastructure to

provide the

expected or

required level of

data and

transaction

protection, and in

the ability of

security program

to proactively

identify and

mitigate risks

Governance, Risk & Compliance

Business Value, Culture,

Principles

Organization/Operating Model

Policy, Procedures, Standards

Training & Awareness

Metrics Tracking & Reporting

Program

/Project Management

Sourcing/Vendor

Management

Financial Management

Security/Risk

Assessment

Issue & Action Management

Statutory/Regulatory

Monitoring

Security Planning & Authorization

Audit and Compliance

Security Analytics

Security Operations Center

Intrusion & Behavior Monitoring

Risk Monitoring

& Analytics

Log Management

Vulnerability & Threat Intelligence

Data Security

Data Classification and Discovery

Confidentiality

Integrity

Data in Motion

Data at Rest

Data in Use

Privacy

Application Security

Requirements Management

Architecture

Secure Coding Practices

Security Testing

and Validation

Vulnerability Management

Incident Management & Response

Vulnerability

Scanning & Testing

Patch Management

Anti

-Malware Management

Network Security

Network Perimeters

Network

Zones

System Placement

Address Space

Management

Endpoint Admission

Cloud Use

Case Protection

Wireless Management

Endpoint Security

End User Security

Compute Platform

Security

Device

Security

Identity & Access Management

IAM Governance & Administration

Provisioning

Authentication

Authorization

Access Management

Federated/Cloud IAM

IAM

Data Directory Services

Service Continuity Management

Disaster Recovery Planning/Testing

Business Impact Assessment

Alternative Processing Strategy

High Availability Strategy

Backup Strategy

Mobile Security

Social Media

Mobile Security

Physical Security

Physical/Logical

Access Integration

Personnel Security & Badging

Data Center Controls

Building Access & Protection

Social Engineering

Change & Configuration Management

Asset/Inventory

Management

Configuration Management

Change/Release Management

Cybersecurity Reference Architecture Mapping

Assessing the maturity of a security program is a

critical first step

Governance

Plan &

Budget

Organization

Controls

EngineeringAwareness

Response

Threat

Management

Risk

Assessment

Key: Health Care Benchmark

Baseline

LAC DHS Security

Maturity Model

dimensions are used to

establish a cybersecurity

strategy.

A series of initiatives are

then identified for maturing

each dimension into the

defined strategy.

The measurement of security maturity includes the aspects of existence,

completeness, comprehensiveness, effectiveness, and efficiency

Risk exposure resulting from current security maturity

facilitates prioritization of the “

Next Dollar Spent

”

App Security

Service Continuity

Change/Config Mgmt

Data Security

Governace-Risk-Compliance

Endpoint Security

Access Mgmt

Mobile/Collaboration Security

Security Analytics

Network Security

Physical Security

Vulnerability Mgmt

• Loss of confidence in ability to provide expected

or required protection

• Remediation: FTE: 4.5 FTE, Capital: $800k

• Loss of confidence in ability to provide

expected level of transaction protection

• Remediation: FTE: 2.5 FTE, Capital: $450k

• Loss of confidence in ability to meet

expectations for service restoration

• Remediation: FTE: 2.0 FTE, Capital: $250k

• Loss of confidence in ability to provide

expected level of infrastructure protection

• Remediation: FTE: 1.8 FTE, Capital: $1.2M

Target-state Maturity

Current-state Maturity

Risk Exposure

Assessing Your

Cybersecurity

Fitness

Systematic and holistic assessment of the

“fitness” of a cybersecurity program

 The hard truth about cybersecurity is that you are never

done.

 So it is important to have a framework to continuously

assess the threats, the cost to the business and the

mitigation measures.

 Our organization is focused on building foundational

controls (access controls, compliance, awareness),

supplementing them with good controls (audits, risk

assessment, governance) and then focusing on advanced

measures (integrated controls, leading indicators, etc.)

 Periodic assessments and report cards inform our

current level of “fitness” and inform our investments

The concept of security is simple.

But executing security in this day and

age is a journey for which there are no

shortcuts. And it’s no longer simply

about technology. It’s expensive and

requires continuous investment. It

takes time and requires constant

attention. It forms complex

relationships and is part of everything

you do. And the need for it never ends.

The hard truth

about security

Cybersecurity Framework

 The Cybersecurity Framework provides a common language for expressing,

understanding, and managing cybersecurity risk, both internally and externally.

 The Framework Core provides references to cybersecurity activities and

Informative References. These activities are mapped to five functional categories;

identify, protect, detect, respond, and recover.

RecoverDetectIdentify

Respond

Protect

 Formal process:

- Measurable

- Repeatable

 Detection and Response:

- Log analysis

- User behavior (access logs)

- Virtual machine scanning

- Data loss prevention

 Risk assessment:

- IT risk (applications and projects)

- Facility risk assessment

- Automation

 Governance:

- Governance committees

- Change management

- Identity access governance

 Strategic planning

 Business alignment:

- Integrate controls with business

process

 Key risk indicator mapping:

- Leading indicators of risk that

influence business decision making

 Behavior shaping:

- Reduce technical controls

 Ethical hacking

 Risk management:

- Enterprise risk

- Accountability

- Scenario risk assessment

Perimeter (network security):

 Firewalls

 Intrusion prevention

Access controls:

 User provisioning (role-based)

 Access management (two-factor)

Vulnerability management:

 Patching (45-day cycle)

 Incident response

Security awareness:

 Training (annual)

 Policy

Organization:

 Staff (roles)

 Skills (certifications)

Compliance:

 Audit

 Requirements management

 E-discovery

A layered system of security controls provides the

best protection

Foundation Controls

Good Controls

Advanced

Maturing Security Strategy

Timeline and Milestones for 90 Day Engagement

Engagement

Management

Assessment

Status Reports

Key

Deliverables

Project

Planning

Summary

Out-brief

Holiday

Checkpoint Calls

Onsite

Kickoff

Planning

Deck

Baseline

Report

Findings

Report

Results

Briefing

Kickoff

Briefing

Roadmap

Report

1. Project Initiation

2. Current-state

Discovery

3. Current-state Definition and

Validation

4. Maturity and Mitigation Analysis and

Validation

5. Roadmap and Strategy Planning and

Validation

Project Closure

6. Final Results

Reporting

Phase 1

Baseline

Phase 2

Evaluation

Phase 3

Remediation

& Reporting

Oct

Dec

Jan

Feb

Mar

Follow-up data collection

next week as necessary

Draft Current-state Report

Validation Review Cycle

On-site data collection

Addressing Your

Cybersecurity

Weak & Strong

Areas

Drive change in weak areas and keep strong in

areas of strength

 Once you understand areas of weakness, it is imperative

that investment dollars are prioritized to mitigate them

 Awareness is key – have a plan and engage in continuous

communications with stakeholders and users in your

organization. More than 40% of reported security

breaches are caused by employee negligence.

 Create a Security Plan that helps prioritize initiatives,

focus on all aspects of cybersecurity (people, processes,

technology).

Cybersecurity program objectives are well defined and a

leadership and organization-wide and responsibility

These five objectives will be used in the updated Cybersecurity Plan at DHS.

Develop Information

Security Staff

Instill Security

Hygiene Controls

Impart consistency in implementing and maintaining information security controls, as

specified in policies or otherwise agreed upon, to manage risk and compliance.

Perform Ongoing

Threat Detection and

Management

Encourage Secure

Employee Behavior

Create Crisis

Response Plan

Objective

Description

Complete regular, scheduled threat detection checks to monitor the environment and, in

case of attacks, generate alerts with as much advance notice as possible.

Instill a culture of secure employee behavior thru training, awareness campaigns, and by

encouraging employees to take ownership of information security and act as “controls”.

Target hiring and development to focus on critical competencies required to protect

against advanced threats and drive business engagement in security activities.

Formulate, and maintain, an actionable plan to rapidly disseminate critical messages to

internal and external stakeholders in the event of a security breach.

Leaders must support cybersecurity as an enterprise-wide risk

business and management issue, not just an IT issue.

Action 1

Leadership must have adequate access to cybersecurity

expertise, and discussions about cyber-risk management

should be given regular and adequate time on meeting

agendas.

Action 2

Leadership must lead by example and set the expectation that

enterprise-wide cyber-risk management frameworks need to be

adhered.

Action 3

We need leadership to engage with staff at all

levels, everyone has a role to play

Cybersecurity is a business problem, not an IT

problem

 Cybersecurity is a business performance

issue that requires business leaders to make

informed choices; it's not a technical

problem buried in IT.

 The complexities of cybersecurity demand a

structured program that supports resilience,

flexibility and accountability.

 Business leaders must be ready for the

present and prepared for the future so there's

an opportunity to anticipate and influence

business initiatives.

• Email: jbrady@dhs.lacounty.gov

• LinkedIn: https://www.linkedin.com/in/jamesbrady/

• Don’t forget to complete online session evaluation!!

Questions?